@custombots/custombot @2.0.2

Summary

index.js opens a TCP connection to a base64-obfuscated IP address (decodes to 85.137.253.124:1111), spawns /bin/sh, and pipes the shell's stdin/stdout/stderr through the socket, giving the remote endpoint an interactive shell on the installer's host. package.json declares "postinstall": "node install.js"; install.js uses node-linux's Service API to install index.js as a Linux systemd service named CustomBot and starts it, aborting unless run as root and prompting the user to run sudo npm i . The combination provides remote code execution against the installer with root privileges and reboot persistence. The C2 IP is stored as the base64 literal 'ODUuMTM3LjI1My4xMjQ=' and decoded at runtime, consistent with deliberate concealment.

Source: amazon-inspector (b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949)